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We assess the overall performance of our quantum key distribution (QKD) system implementing 
the measurement-device-independent (MDI) protocol using components with varying capabilities 
such as different single photon detectors and qubit preparation hardware. We experimentally show 
that superconducting nanowire single photon detectors allow QKD over a channel featuring 60 dB 
loss, and QKD with more than 600 bits of secret key per second (not considering finite key effects) 
over a 16 dB loss channel. This corresponds to 300 km and 80 km of standard telecommunication 
hber, respectively. We also demonstrate that the integration of our QKD system into FPGA- 
based hardware (instead of state-of-the-art arbitrary waveform generators) does not impact on its 
performance. Our investigation allows us to acquire an improved understanding of the trade-offs 
between complexity, cost and system performance, which is required for future customization of 
MDI-QKD. Given that our system can be operated outside the laboratory over deployed hber, we 
conclude that MDI-QKD is a promising approach to information-theoretic secure key distribution. 


I. INTRODUCTION 

Quantum key distribution (QKD) jlHliJ is the most ma¬ 
ture application of quantum information processing - it 
allows two parties (commonly known as Alice and Bob) 
to exchange information-theoretic secure cryptographic 
keys. During the past decade, experimental work has 
focussed on the development of systems delivering secret 
keys over deployed fiber at high rates EH2, over hundreds 
of kilometres |5j, and in trusted-node networks [zii. 
Furthermore, commercial systems are available for pur¬ 
chase [9]. 

From a theoretical point of view, the security of QKD 
is guaranteed by the laws of quantum mechanics. How¬ 
ever, in practice, the physical devices employed in QKD 
systems never perfectly agree with theoretical descrip¬ 
tions. This disparity has led to attacks that compromise 
the security of real systems [TOMT] , Most importantly, 
certain attacks known as ‘blinding attacks’, ex¬ 

ploit vulnerabilities of single-photon detectors (SPDs) to 
allow an eavesdropper to remotely control all SPDs. In 
fact, the majority of successful attacks have targeted the 
SPDs of QKD systems. 

Protecting practical QKD systems against these ‘side- 
channel’ attacks is a difficult problem, which is cur¬ 
rently being investigated by many research groups. Some 
strategies include developing counter-measures to specific 
attacks on m and developing techniques to eliminate 


specific weaknesses of devices [23]. However with such 
approaches it is difficult to fully characterize and quan¬ 
tify all possible weaknesses and corresponding attacks, 
and it may be possible for an eavesdropper to circum¬ 
vent the countermeasure. Another approach is to de¬ 
velop protocols that are intrinsically secure against side- 
channel attacks, such as device-independent QKD (DI- 
QKD) [23}|22], in which no devices have to be trusted and 
security is guaranteed via a loophole-free Bell-inequality 
violation. Unfortunately, despite much effort E1I27], a 
loophole-free Bell test has yet to be achieved and the im¬ 
plementation of DI-QKD therefore seems unlikely in near 
future. 

More recently, several groups have proposed QKD 
protocols that are intrinsically secure against the most 
dangerous side-channel attacks, namely all possible 
(i.e. known or yet-to-be-proposed) detector side- 
channel attacks, while requiring proper functioning 
of other devices [25H52] . The first such protocol, 
known as measurement-device-independent QKD (MDI- 
QKD) [281 . was inspired by time-reversed entanglement- 
based QKD [32, :33] and, for maximum secret key rate, 
requires a Bell state measurement (BSM) at a cen¬ 
tral station (henceforth referred to as Charlie) to create 
entanglement-like correlations between Alice and Bob. 
Note that even if an adversary completely controls the 
measurement device (including the detectors) and, e.g. 
replaces the entangling measurement by any other mea- 
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FIG. 1. Schematic of the setup to implement the MDI-QKD protocol. The figure shows two qubit sources labeled as Bob’s 
source and Alice’s source that send qubits through a quantum channel to Charlie, a third untrusted party, who performs a Bell 
state measurement. 


surement, he would not gain any information about the 
cryptographic key. Hence, as no assumptions about the 
functioning of the measurement apparatus are required, 
MDI-QKD is intrinsically immune to all detector side- 
channel attacks. Thus, MDI-QKD provides enhanced se¬ 
curity as compared to traditional QKD. 

The MDI-QKD protocol has other important bene¬ 
fits. For instance, it is natural to extend the MDI-QKD 
scheme to star-type network topologies, in which a large 
number of users is connected to the same central sta¬ 
tion, i.e. Charlie, who connects pairs of users on de¬ 
mand. Such a design is more cost-effective per user than 
quantum networks comprised of individual point-to-point 
links [8]. Also, MDI-QKD is a natural stepping stone to¬ 
wards quantum repeaters, which is one approach towards 
truly long-distance quantum communication [35]. 

On the other hand, similar to the case of quan¬ 
tum repeater-based communication, MDI-QKD faces the 
challenge of BSMs with photons created by distant, and 
independent, photonic qubit sources. Such a measure¬ 
ment requires nearly complete indistinguishability of the 
photons from each source upon arrival at Charlie’s, in¬ 
cluding polarization, temporal and spectral profiles. The 
latter is determined largely by local properties of the 
sources and can thus be easily controlled. However, po¬ 
larization and arrival-time fluctuate due to time-varying 
properties of the entire quantum channel between the 
sources and the central station, as birefringence and re¬ 
fractive index of optical fiber are temperature dependent. 
Ensuring indistinguishability thus requires feedback sys¬ 
tems that counteract external environmental changes. 
The first demonstration of a BSM with photons from 
independent and widely separated sources was demon¬ 
strated only recently [55 - explicitly for MDI-QKD. 

Due to its many advantages, MDI-QKD has received 
much attention from experimental groups and has been 
demonstrated in several configurations. The feasibility of 
MDI-QKD was first demonstrated in [35] using time-bin 
encoding over up to 80 km of spooled fiber as well as 
over 18.6 km of deployed fiber across a city centre, and 
in [37] (using the same type of encoding) over 50 km of 
spooled fiber and with random modulation of all bases 


and states, as required for actual key distribution. Sub¬ 
sequent experiments employed polarization qubits in a 
lab setting with quantum signals frequency-multiplexed 
with classical signals [38] , and with pre-set random state 
and basis modulation [39]. Most recently, MDI-QKD 
has been demonstrated over 200 km of spooled optical 
fiber [40] , and in fully-automated fashion and over a real- 
world link m- 

Our previous experiments have demonstrated the 
proof-of-principle of MDI-QKD over spooled as well as 
deployed fiber using a particular configuration for Alice, 
Bob and Charlie [35] (in these measurements, only the 
quantum channel changed). Here we assess the impact 
of using components with varying capabilities - single 
photon detectors and qubit-preparation hardware - on 
overall system performance, i.e. secret key rates, and 
maximum tolerable transmission loss. This allows us to 
develop a better understanding of the trade-offs between 
complexity, cost, and system performance, which is re¬ 
quired for future customization of QKD systems. 

This paper is organized as follows: In section [H[ we 
describe the MDI-QKD protocol and in section [Hd] a 
detailed description of the realization of our MDI-QKD 
system is presented. In section |IV[ we specify different 
configurations in which our MDI-QKD system is tested 
and then discuss results of these tests. We conclude in 
section El 


II. THE MDI-QKD PROTOCOL 

Sources of quantum states are at Alice’s and Bob’s sta¬ 
tions. To encode classical bits, they randomly choose a 
basis and a state among the four BB84 states. In the case 
of time-bin qubits, these may correspond to the states |e) 
and |Z) (i.e. eigenstates of the Pauli operator az, form¬ 
ing the so-called Z-basis), or to |+) = (|e) + 1 l))/\/2 and 
|—) = (|e) — |Z))/v / 2 (i.e. eigenstates of the Pauli operator 
ax, forming the so-called X-basis), where |e) and 1 1) de¬ 
note the emission of a photon in an early or late temporal 
mode, respectively. Furthermore, they associate |e) and 
|+) with a classical bit value of 0, and |Z) and |—) with 
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a classical bit value of 1. The qubits are sent through 
quantum channels to a third station at which Charlie 
performs a Bell state measurement (see Figure |Tj) that 
projects their joint state onto one of the four maximally 
entangled Bell states: 

IV’ab) = |e^s) ± I UeB)), 

I&ab) = y^d eAes ) ± \ 1a1b ))- (!) 

Once a sufficient number of qubits has been transmit¬ 
ted |42j . Charlie announces which of his joint measure¬ 
ments resulted in one of the four states of Eq. [TJ as well 
as the result of the measurement (note that to ensure 
security, Charlie only needs to be able to project onto 
one Bell state, but access to more Bell states will in¬ 
crease performance). As a next step, Alice and Bob per¬ 
form a basis reconciliation procedure known as key sift¬ 
ing. In this step, for each successful projection onto a 
Bell state, Alice and Bob reveal and compare the bases 
employed to prepare their respective qubits over an au¬ 
thenticated classical channel and keep only the events in 
which they used the same basis. Next, depending on the 
result of the BSM and his preparation basis, Bob must 
post-process his bit values to ensure identical bit values 
to Alice. For example, Bob performs a bit flip if the an¬ 
nounced measurement resulted in I^ab), which indicates 
anti-correlated bits in both the X- as well as the Z-basis. 
Furthermore, due to unavoidable experimental imperfec¬ 
tions such as faulty qubit preparation, channel noise and 
noisy single photon detectors, as well as possible eaves¬ 
dropping, it is necessary to go through a key distilling 
process: After publicly revealing a subset of their pre¬ 
pared bit values, Alice and Bob estimate the error rate 
for each basis independently, and then perform error cor¬ 
rection on the Z-basis bits to remove all discrepancies 
in their Z-keys (i.e. the key bits associated with prepa¬ 
rations in the Z-basis). The error rate for the X-basis 
is used to bound information that an eavesdropper could 
have obtained during photon transmission and detection; 
it is removed by means of privacy amplification. The final 
secret key rate is given by: 

S>[Q z [l-h 2 {e x )\-Q z fh 2 {e z )\ (2) 

in which Q refers to the gain (the probability of a projec¬ 
tion onto a Bell state per emitted pair of qubits), e indi¬ 
cates error rates (the ratio of erroneous to total projec¬ 
tions a Bell state), h 2 is the binary Shannon entropy and 
/ refers to the efficiency of error correction with respect 
to Shannon’s noisy coding theorem. The superscripts x 
or z indicate to which basis a particular variable refers. 

Due to the need for qubits encoded into individual pho¬ 
tons, the above-described implementation is currently 
difficult to implement. However, by taking advantage 
of so-called decoy states, it is possible to use phase- 
randomized weak coherent states (i.e. attenuated laser 


pulses, which sometimes contain more than one photon) 
[28j I42H44] , which are straightforward to generate with 
current technology. This is similar to traditional prepare 
& measure-type protocols [I5HT7] . By randomly modu¬ 
lating the mean photon number of the laser pulses be¬ 
tween several values known as ‘signal’ and ‘decoy’ (the 
optimal values of which depend on the implementation 
HU US]), one can assess the gains and error rates associ¬ 
ated with single-photon emissions. The secret key rate is 
then given by: 

^ > [Ql r[l - h 2 (e^)\ - QlJh 2 {el a )\. (3) 

The ‘11’ subscript indicates values for gain and error rate 
stemming from Alice and Bob both emitting a single pho¬ 
ton, and the subscript ‘/rcr’ denotes values associated with 
mean photon numbers per ‘signal’ pulse of /i and <7, emit¬ 
ted by Alice’s and Bob’s, respectively. As in Eq. [2j the 
basis is indicated using a superscript. 

III. REALIZATION OF OUR MDI-QKD 
SYSTEM 

The experimental setup of our MDI-QKD system can 
be divided into four parts: qubit preparation, quantum 
channel, feedback systems, and the BSM unit. We have 
tested our system with various sources and single photon 
detectors, and in the following subsections we present a 
detailed description of each part of our system for each 
of the configurations used in our MDI-QKD demonstra¬ 
tions. 


A. Qubit preparation 

In our MDI-QKD system, Alice and Bob prepare time- 
bin qubits in one of the four BB84 states introduced 
above. In our work, time-bin qubits are prepared by 
externally modulating a continuous wave (CW) laser at 
1552 nrn wavelength with a commercial intensity modu¬ 
lator (IM1) and a phase modulator (PM1), as depicted 
in Figure [2] The time-bin qubits in the X- and Z-basis 
are prepared by providing different electronic pulses to 
IM1 and PM1. By changing the attenuation of the op¬ 
tical attenuator (ATT), different mean photon numbers 
for the time-bin qubits are obtained, as required for the 
decoy state protocol. In our experiments, the mean pho¬ 
ton numbers of the signal and decoy states are optimized 
through a theoretical model of MDI-QKD to obtain the 
highest final key rate for each distance [15] , The phase 
of the qubits is uniformly randomized by applying an 
electronic signal with randomized amplitudes to PM2, 
which ensures protection against the unambiguous-state- 
discrimination (USD) attack 1191121 j . Note that PM2 
was not included in some of the measurements described 
below, and some measurements furthermore employed 
only one CW laser, whose output was split and sent 
to Alice and Bob for qubit preparation (deviations from 
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FIG. 2. Experimental setup of our MDI-QKD system (see main text for details). LD: laser diode, PM1 and PM2: phase 
modulator, IM: intensity modulator, ATT: attenuator, POC: polarization controller and measurement, AWG/SG: arbitrary 
waveform generator or FPGA-based signal generator (depending on implementation), PBS: polarization beam splitter, BS: 
beam splitter, SPD: single photon detector. 


the generic setup depicted in Figure [2] will be mentioned 
again in section IVI. It is also worth noting that time-bin 
qubits can also be prepared using a directly modulated 
pulsed laser in conjunction with an unbalanced Mach- 
Zehnder interferometer, IMs and PMs m- 

For our experiments, we use and compare two different 
electronic driving devices: a commercially-available arbi¬ 
trary waveform generator (AWG) and a home-made sig¬ 
nal generator (SG) based on a field programmable gate 
array (FPGA) and suitable drivers that transform the 
FPGA outputs into appropriate analog signals. We de¬ 
veloped our signal generator as a cost-effective and com¬ 
pact solution to replace the AWG in anticipation of future 
development of commercial MDI-QKD system. With the 
AWG we generate time-bin qubits with a temporal mode 
width of 100 to 500 ps and a temporal mode separation 
between 1.5 and 2.5 ns. With our signal generator we 
generate time-bin qubits with a temporal mode width of 
290 ps and a temporal mode separation of 2.5 ns. We 
characterize the time-bin qubits according to the proce¬ 
dure described in j49j. Motivated by our setups, which 
create imperfect pure states, we consider time-bin qubits 
of the form 


would be zero. We measured these parameters for both 
implementations; the results are given in Table [I] As one 
can see, the parameters barely change when moving from 
an AWG to our signal generator. The impact on overall 


system performance will be described in section IV B 


Parameter 

AWG 

SG 

^z=0,l,x= —,+ 

(5.34 ± 0.91)x 10 -5 

(2.57 ± 1.18)xl0“ 5 

m z=0 

(0.986 ± 0.012) 

(0.982 ± 0.010) 

m z=1 

0 

0 

m x= -’ + 

(0.4963 ± 0.0042) 

(0.4963 ± 0.0062) 

<t> z =°' x = cf) x = + {rad] 

0 

0 

cj) x= ~ [rad] 

tt+(0.075 ± 0.015) 

tt+(0.075±0.015) 


TABLE I. Measured values for m x,z and b x ’ z for time- 
bin qubits prepared using an arbitrary waveform generator 
(AWG) and our FPGA-based signal generator (SG), respec¬ 
tively. 


B. Quantum channel 


\ib) = , — + b x ’ z |e) 

>/l + 2 b x ’ zK 

+ e i0X ’Vl - m x ’ z + b x ’ z |Z)). (4) 

Here |e) and |() denote orthogonal early and late tem¬ 
poral modes, respectively. m x ’ z and b x,z are deter¬ 
mined by the properties of the electronic signals from 
the AWG/SG (e.g. the amplitude, and rising and falling 
edges of the pulses), and the extinction ratio (ER) of 
IM1. Furthermore, the superscript indicates to which 
basis/state the parameter applies (e.g. m z=0 applies to 
the state produces when Alice or Bob chooses the Z-basis 
state |Z)). For a perfect time-bin qubit preparation setup, 
m z=0,1 = 0 or 1 for qubits in the Z-basis, and m x ~ + '~ = 
0.5 for qubits in the X-basis; cf> x=+ '~ = 0 or n for qubits 
in the X-basis (in the Z-basis 4> z is irrelevant) and b x,z 


After preparing the time-bin qubits, Alice and Bob 
send them to Charlie through two different quantum 
channels (i.e. optical fibers). First, we note that loss 
during transmission (in conjunction with detector noise) 
increases the error rate, and this limits the maximum 
distance for MDI-QKD. Second, ideally, the propaga¬ 
tion times of the photons through the fibers should re¬ 
main constant, and the polarization state of the time- 
bin qubits should not be affected. Unfortunately, both 
properties change due to dynamic properties of real-world 
fiber links. Figure [3] (a) shows the change of the differ¬ 
ential arrival time of attenuated laser pulses from Alice’s 
and Bob’s, which we previously reported in HI6L over a 
deployed fiber across the city of Calgary; Figure[3](b) de¬ 
picts the overlap between the polarization states of orig¬ 
inally horizontally polarized light from Alice and Bob 
after propagation to Charlie. It can be seen that both 
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the differential arrival time and the overlap of the polar¬ 
ization states vary over time and are correlated to the 
outside temperature. As shown in Figure [3j the differ¬ 
ential arrival time varies from -1.6 ns to 0.8 ns in three 
hours (hours 12-15), during which the temperature in¬ 
creases from -14 °C to -4 °C; and the polarization over¬ 
lap can vary from 0 (orthogonally polarized pulses) to 1 
(identically polarized pulses) in much less than one hour. 
Hence, to realize a stable MDI-QKD system, we devel¬ 
oped active feedback subsystems that control the prop¬ 
agation time and polarization fluctuation, the details of 
which are given in section [ill C| 


1. Temporal overlap 

Charlie distributes optical clock signals (at 10 MHz) 
to Alice and Bob via a second optical fiber, which they 
convert to electrical pulses. This master clock is used 
to synchronize all relevant devices at Alice’s, Bob’s and 
Charlie’s. To ensure sufficient temporal overlap, Char¬ 
lie measures the arrival time of Alice’s and Bob’s pulses 
independently every few minutes using a time-to-digital 
converter (TDC) and SPDs. He then applies an appro¬ 
priate delay to the distributed clock signal to match the 
arrival time difference of signals emitted at Alice’s and 
Bob’s within 30 ps. 


C. Feedback systems 


2. Polarization overlap 


The main technological challenge to implement MDI- 
QKD is to perform a BSM with photons from inde¬ 
pendent sources that travelled through two indepen¬ 
dent fibers. For this measurement, one requires the two 
photons to be approximately indistinguishable, i.e, they 
should have sufficient temporal, polarization, and spec¬ 
tral overlap. To this effect, we implement different feed¬ 
back mechanisms. 
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FIG. 3. (a) Differential arrival time of attenuated laser pulses 
propagation from Alice/Bob to Charlie, (b) Variation in 
polarization overlap of originally horizontally polarized light 
propagation from Alice/Bob to Charlie. The temperature 
data (crosses) is given in the secondary y-axes, showing cor¬ 
relation with variations of differential arrival time and polar¬ 
ization overlap (the figure is identical to that in [36]). 


Charlie sends strong vertically polarized light for 250 
ms every 10 seconds through the links to Alice and Bob. 
Alice and Bob measure its polarization and prepare their 
qubits orthogonal to that. This ensures that the qubits 
from Alice and Bob, after travelling through the link, 
will be identically (horizontally) polarized at Charlie and 
arrive at the BS. Note that the PBSs in Charlie’s sys¬ 
tem ensure that polarization fluctuations transform into 
added loss, and not decreased indistinguishability. For 
additional details see [361. 


3. Spectral overlap 

Alice and Bob split some of their laser light that is used 
to prepare qubits and continuously send it to Charlie via 
the second optical fiber. Charlie monitors the frequency 
difference between the two lasers using their beat note 
signal. Whenever the frequency difference is greater than 
the threshold of 10 MHz, Charlie communicates the fre¬ 
quency difference to Alice. To maintain sufficient spectral 
overlap, Alice uses a frequency shifter comprising a phase 
modulator to which appropriate linear phase chirps are 
applied using a serrodyne modulation signal. 


D. BSM unit 

The BSM unit for time-bin qubits consists of a 50:50 
beam splitter followed by two SPDs, as shown in Figure[2] 
The two-photon projection measurement occurs by over¬ 
lapping the two photons on the beam splitter - to erase 
which-way information - and subsequently detecting the 
two photons. A projection onto | i/^ab) characterized by 
a coincidence detection in orthogonal temporal modes in 
different detectors while a projection onto \’4>\ B ) is char¬ 
acterized by a coincidence detection in orthogonal tem¬ 
poral modes in the same detector. All other coincidence 
detections (i.e., detections in the same temporal mode) 
project onto product states. It has been shown that the 
Bell state measurement efficiency (i.e. the probability 
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Configuration 

Lasers 

PM2 

Qubit generation 

Detector 

Channel 

Total channel length 

Total channel loss 

1 

2 

no 

AWG 

id201 

Deployed 

18.6 km 

9 dB 

2 

2 

no 

AWG 

id201 

Spool 

20, 40, 60 km 

9.1, 13.7, 18.2 dB 

3 

1 

yes 

AWG 

id210 

Spool 

60, 100 km 

13.7, 20 dB 

4 

1 

yes 

AWG 

SNSPD 

ATT 

- 

16, 40, 60 dB 

5 

1 

yes 

SG 

SNSPD 

ATT 

- 

16 dB 


TABLE II. MDI-QKD system configurations assessed in this work. We list the number of lasers used, the presence of PM2, the 
hardware employed for qubit generation (AWG or SG), and the single photon detectors (id201, id210 or SNSPD). Quantum 
channels include short fibers with attenuators (ATT), spooled fiber, and deployed fiber across the city of Calgary. 


that two independent photons are projected onto an en¬ 
tangled state) is limited to 50% when using only linear 
optics and no auxiliary photons [50]. Note that we only 
monitor projections onto IV’as) f° r the results discussed 
here, which reduces the maximum efficiency (assuming 
lossless detection) to 25%. However, BSM projections 
onto both IV'as) and \^ab) have been demonstrated [51] . 

The performance of the BSM unit, and in turn an MDI- 
QKD system, is determined by several detector proper¬ 
ties, including the detection efficiency rjdet, noise, gate 
rate, recovery time, and detector type. For our measure¬ 
ments, we employ three different types of detectors: two 
different types of InGaAs-based SPDs from idQuantique 
(id201 and id210), as well as superconducting nanowire 
single photon detectors (SNSPDs) [223- The technical 
specifications are summarized in Table m While the 
SNSPDs have far superior properties, they are more cum¬ 
bersome to use due to more stringent cooling require¬ 
ments. 


IV. PERFORMANCE OF DIFFERENT 
MDI-QKD CONFIGURATIONS - 
MEASUREMENTS, RESULTS AND DISCUSSION 

We tested our system in 5 different configurations (see 
Table 0 and over different quantum channels, which 
allows us to assess the trade-offs between system per¬ 
formance (in terms of secret key rates or maximum 
distance), complexity, and cost. The configurations 
are characterized by different qubit-generation hardware 
(AWG or SG), the number of lasers employed (1 or 2), 


SPD 

id201 

id210 

SNSPD 

Dark count probability 3. 

-10~ 4 

-10 -5 

-lo- 7 

Deadtime 

10 s 

10 fis 

40 ns 

Maximum gate rate 

8 MHz 

100 MHz 

free running 

Detector efficiency 

-15% 

-15% 

-50% 

Maximum count rate 

0.1 MHz 

0.1 MHz 

2 MHz 

Afterpulsing a 

- 10 -5 

-10 -5 

- 0 

Temperature 

- 223 K 

- 223 K 

-1 K 


TABLE III. Properties of various SPDs we employed ( a per 
ns) 


the presence of PM2 (used to phase-randomize the laser 
pulses), and the type of SPDs (id201, id210, SNSPD). 
Quantum channels are either short fibers with variable 
loss (implemented using variable attenuators), spooled 
fiber (without additional attenuator), or deployed fiber. 

For each configuration, we created the same combina¬ 
tion of quantum states and intensities (i.e. signal or de¬ 
coy states) at Alice’s and Bob’s until we gathered enough 
data, and then changed the states and/or the intensities 
as required by the decoy state protocol described in [35] . 
Using Eq. [3] we then calculated the secret key rates per 
gate and per second, which are shown in Figures [4] and [5] 
respectively (Figure [4] additionally shows predicted val¬ 
ues using the model described in [49]). In the following 
sections we will discuss the impact of changing compo¬ 
nents of our QKD system on its performance. 


A. Quantum channels — real-world versus spooled 
fibers 

Configurations 1 and 2 are identical except for the 
quantum channel real-world fiber deployed across the 
city of Calgary, and spooled fiber inside a temperature- 
controlled laboratory, respectively (these results have al¬ 
ready been presented in [3B]). In the absence of signifi¬ 
cant environmental effects on the deployed channel, the 
corresponding secret key rates would be identical. How¬ 
ever, as described above, the differential arrival time and 
the polarization overlap vary on time-scales of less than a 
minute. Hence, without properly functioning active sta¬ 
bilization, secret key rates would be significantly reduced. 
However, as one can see in Figure [4] we find nearly identi¬ 
cal secret key rates, indicating that our feedback systems 
compensate for the environmental fluctuations as well as 
time-varying laser frequency differences. Note that our 
feedback systems have bandwidth limitations (which we 
have not yet assessed), i.e. will compensate only for suffi¬ 
ciently slow fluctuations. This may affect the maximum 
distance over which our QKD system can be employed 
outside the laboratory, even if it still delivers secret key 
over spooled fiber of the same length inside the lab. 
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B. Qubit preparation — AWG versus FPGA-based 
signal generator 


Next, we compare the performance obtained with con¬ 
figuration 4 and 5, which only differ in the hardware used 
for preparing qubits - AWGs or FPGA-based signal gen¬ 
erators (SG). Due to bandwidth differences between the 
AWG and the SG, the parameters of the prepared time- 
bin qubits - temporal mode width and temporal mode 
separation - are insignificantly different (see Table IVI. 
The measured secret key rates per gate for a 16 dB loss 
channel are shown in Figure |4j along with our theoreti¬ 
cal prediction. We find very good agreement in case of 
configuration 5 (SG-based qubit preparation), and rea¬ 
sonable agreement in case of configuration 4 (AWG-based 
qubit preparation). We attribute the difference mainly to 
statistical fluctuations (both points overlap within their 
2 a uncertainty). Hence, we find that our home-made, 
cost-effective signal generator produces quantum states 
of similar quality as the state-of-the-art AWG. This con¬ 
clusion is also supported by the data in Table [TJ 


Devices Temporal mode Temporal mode 

width (FWHM) (ps) separation (ns) 
AWG 250 2.50 

FPGA board 290 2.50 

TABLE IV. Parameters of prepared time-bin qubits for con¬ 
figurations 4 and 5 (see Table [TTj). 
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FIG. 4. Experimentally obtained secret key rates per gate 
versus total loss in the quantum channel. Curve A shows the 
theoretical prediction assuming configuration 1 or 2, curve B 
assuming configuration 3, and curve C assuming configura¬ 
tion 4 or 5. Experimentally obtained key rates for the differ¬ 
ent configurations are plotted as well. All configurations are 
described in Table [II] The secondary x-axis shows distance 
assuming 0.2 dB loss per kilometre of fiber. Uncertainties 
(one standard deviation) are calculated assuming Poissonian 
statistics of all measured gains and error rates. 


C. Impact of different single photon detectors 


Configurations 1-5 differ in the single photon detectors 
employed for the BSM, the quantum channel (deployed 
fiber, spooled fiber and variable attenuator), the number 
of lasers used to create qubits, as well as the hardware 
employed for the latter. However, given that our feed¬ 
back system operates reliably (as discussed in section 
III C), and ignoring the small difference between AWG 


and SG-based qubit creation (see section III A), we as¬ 


sume in the following that all differences in secret key 
rates have to be attributed to different SPDs. (Detector 
performance is characterized in Table [TTT| ) From the data 
shown in Figures [4] and [5j we find that the secret key rate 
(in bits per gate) is significantly impacted by the use of 
different detectors. 

As expected, because of their superior detection effi¬ 
ciency and lower noise, the key rate per gate for a spe¬ 
cific amount of channel loss (i.e. distance) is higher with 
SNSPDs compared to id201 and id210 InGaAs SPDs. For 
the same reason, the maximum distance between Alice 
and Bob is larger. More precisely, the maximum distance 
over which MDI-QKD can be performed using id201 de¬ 
tectors is 80 km. Using id210 detectors it increases to 125 
km, and for SNSPDs we find 430 km (these estimations 
assume fiber loss of 0.2 dB/km. Note that fibers with 


less loss are now available 153), but are probably not yet 
deployed). At distances below ~50km, the key rate per 
gate when using id201 detectors is close to that of using 
id210 detectors because of similar detection efficiencies 
(solid and dash-dotted curves in Figure [4]), but employ¬ 
ing id210 detectors results in greater distances because 
of their lower noise (refer to Table |III[ ) . 

It is worth noting that, as shown in Figure [5] when us¬ 
ing SNSPDs, the secret key rate (in bits per second - not 
per gate) over low-loss links is limited by the detectors’ 
maximum count rates, in our case around 2 MHz. To 
ensure that we do not exceed this rate (in which case the 
detectors would stop operating), we reduce our qubit gen¬ 
eration rate from its maximum of 250 MHz to 20 MHz as 
the quantum channel loss is reduced from 40 dB to 16 dB. 
Furthermore, when using InGaAs based detectors, the fi¬ 
nal key rate is always limited by the deadtime we set to 
minimize the afterpulsing, ~ 10 p,s. Figure [5] shows the 
secret key rate in bits per second when different detectors 
are employed (the figure also specifies different qubit gen¬ 
eration rates). We find the maximum key rate to be 623 
Hz (obtained with SNSPDs over a total channel loss of 
16 dB), and that the key rate per second is higher using 
id210 detectors than with id201 detectors. This is due 
to the lower noise and higher gate rates (25 MHz com- 
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FIG. 5. Secret key rates per second versus loss in the quantum 
channel for all configurations specified in Table |TT] and for 
different qubit generation rates. Uncertainties (one standard 
deviation) are calculated assuming Poissonian statistics of all 
measured gains and error rates. 


pared to 2 MHz) of the id210 detectors (for more details 
see [M]). Note that finite key effects were not taken into 
account in calculating secret key rates [42] . 


rated locations, and efficient and low noise single photon 
detection. Furthermore, implementing the decoy-state- 
protocol based on quantum random number generators 
(QRNGs) connected to our signal generators and drivers 
would, first, neither change our results in Figure 0] nor 
our conclusions, and second, is well understood pj and 
thus straightforward, albeit laborious, to do. Moreover, 
the operation of high-rate QRNGs, while a challenge, has 
been reported before and is independent of the 

choice of the QKD protocol. The same applies to real¬ 
time, fast and efficient, error correction and privacy am¬ 
plification [7], Hence, we do not foresee any significant 
challenges in creating a complete QKD system. 

These findings demonstrate that MDI-QKD is already 
suitable for compact and cost-effective real-world imple¬ 
mentations, even though the protocol was proposed only 
in late 2011. Furthermore, we find that secret key rates 
benefit from using SNSPDs. The drawback of being 
more expensive and more complex than InGaAs-based 
SPDs will be largely offset in star-type quantum net¬ 
works, where a single BSM (i.e. two SNSPDs) can serve 
a large number of users. Next development steps of our 
system concern the integration of true random number 
generators, testing over real-world links exceeding dis¬ 
tances of 100 km and in networks, and interfacing with 
quantum repeaters [551 . 
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